PT-2014-2759 · Plone Foundation · Plone

Published 2014-03-11 · Updated 2022-05-17 · CVE-2013-4196

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.1 through 4.1 Plone versions 4.2.x through 4.2.5 Plone versions 4.3.x through 4.3.1

Description The issue is related to the object manager implementation in the objectmanager.py file, which fails to properly restrict access to internal methods. This allows remote attackers to obtain sensitive information by sending a crafted request.

Recommendations For Plone versions 2.1 through 4.1, update to a version that properly restricts access to internal methods. For Plone versions 4.2.x through 4.2.5, update to a version that properly restricts access to internal methods. For Plone versions 4.3.x through 4.3.1, update to a version that properly restricts access to internal methods.

Fix

Information Disclosure

Weakness Enumeration

CWE-264

CWE-200

Related Identifiers

CVE-2013-4196

GHSA-QPHH-5FV5-2MJJ

PYSEC-2014-60

Affected Products

Plone

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2013-4196 · Security Note
• http://plone.org/products/plone/security/advisories/20130618-announcement · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qphh-5fv5-2mjj · Vendor Advisory
• http://plone.org/products/plone-hotfix/releases/20130618 · Patch
• https://osv.dev/vulnerability/PYSEC-2014-60 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-60.yaml · Note
• https://github.com/plone/Plone · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=978475 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4196 · Note
• http://seclists.org/oss-sec/2013/q3/261 · Note